Apache HTTP Server 2.4.71 ships a critical HTTP/2 code-execution fix
The latest release closes three vulnerabilities, the top of the trio being a remotely exploitable RCE in the HTTP/2 module.
The Apache Software Foundation and its httpd project released Apache HTTP Server 2.4.71 today, and in its announcement the Foundation calls the new build "the best version of Apache available," urging users of all prior versions to upgrade. That's a bold claim for 31-year-old infrastructure software, but the project isn't just reaching for the thesaurus. At its core this is a security release. One of the three flaws it closes is a critical remote code-execution bug in the HTTP/2 module.
CVE-2026-119618 lands inside mod_http2's assign_headers() function. It's a race condition triggered by concurrent execution that can corrupt the heap and, worse, hand an attacker the ability to run code remotely. The affected range is broad. Anything from 2.4.55 through 2.4.70 sits in the blast radius, so if you've been serving HTTP/2 traffic without patching for a while, this one wants your attention.
The disclosure chain is worth a look too. Anthropic's OSS Scanner caught the flaw, tracked as ANT-2026-MAPKT6MZ, with Google Cloud's Vulnerability Research team confirming it. Reported October 26 and shipped November 11, the turnaround was tight but clean.
The other two flaws
Not every finding here is a home run. The "important" CVE-2026-106023 lives in mod_md, the module that auto-manages TLS certificates over ACME. A NULL pointer dereference during request processing kills the affected server child process, which really comes down to denial of service. Annoying, but not apocalyptic.
The catch is the range. mod_md has been around since 2.4.30, so this flaw spans from 2.4.30 all the way to 2.4.70. That's a very wide swath of releases for what amounts to a crash-only bug.
The low-severity third, CVE-2026-109163, is a single-byte stack buffer overflow in mod_vhost_alias. Only 2.4.69 and 2.4.70 are affected, which means it's already gone once you jump to 2.4.71. It's the follow-up to another mod_vhost_alias overflow fixed back in 2.4.69. Someone kept poking at the same code path and found another crack.
Quick note on timing. 2.4.70 dropped just five days before this release, on November 6. Look further back and you'll see a nonstop run of security-heavy releases: 2.4.67 in May, 2.4.68 in June, 2.4.69 in October, and now 2.4.71. Most maintainers would be winded by that cadence.
2026 has been a heavy year for Apache flaws. 2.4.69 alone carried 20 CVEs. 2.4.68 had 13. 2.4.67 delivered a double-free with possible RCE on early HTTP/2 resets. The pattern is becoming readable. mod_http2 and the proxy modules take the most hits, with .htaccess privilege-escalation bugs lingering at the edges. Apache does a lot more today than serve static files. It's an application gateway now, and bigger attack surfaces tend to breed more bugs.
It's a fair amount of ground to cover in a single year. The acknowledgements read like a roll call of the security industry: Anthropic, Google Cloud, the 360 TuLongFeng team, striga.ai, CloudLinux and TuxCare, plus a handful of independent whitehats. That's open-source security working as advertised. It's also a quiet reminder that most of the actual hunting happens outside the project's core, on the backs of external researchers and vendor bounties.
A small aside, since I know this one trips people up: Wikipedia hasn't caught up. As of this writing, its infobox still lists 2.4.70 as the latest stable build, even though the official download page confirms 2.4.71. Cite the Apache site directly if you're linking.
What you should do
Upgrade to 2.4.71 if you're on anything from 2.4.55 through 2.4.70, where the HTTP/2 flaw lives. Do the same if you use mod_md, or the affected mod_vhost_alias setups.
Two things before you install. First, check your APR and APR-Util versions. You need at least 1.5.x, and 1.6.x if you're leaning on newer features. Keep in mind that the announcement calls this mandatory: the APR libraries must be upgraded for all of httpd's features to run correctly. Second, if you run a threaded MPM (anything but Prefork), make sure every third-party module is actually thread-safe.
And for everyone still on 2.2.x: that branch hit end of life in July 2017. No more patches. No more fixes. Moving to 2.4.x is a security decision as much as a feature one.
Head here to download the new release. The security advisory with the complete CVE list is available here.
